





<!DOCTYPE html>
<html>
<head>
  
  <meta http-equiv="content-type" content="text/html; charset=UTF-8">
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <link rel="stylesheet" type="text/css" href="./css/leak-styles.css"/>
  <title>WikiLeaks - Vault 7: Projects</title>
  
</head>

<body>
      <div id="submit_wlkey" class="submit_elem">
	<div class="container">
		<div class="text-center"><div class="submit_buttons btn-group" role="group">
			<a href="#submit_help_contact" class="btn-wl btn-wl-empty">How to contact WikiLeaks?</a>
			<a href="#submit_help_tor" class="btn-wl btn-wl-empty">What is Tor?</a>
			<a href="#submit_help_tips" class="btn-wl btn-wl-empty">Tips for Sources</a>
			<a href="#submit_help_after" class="btn-wl btn-wl-empty">After Submitting</a>
		</div></div>

		<p>Key fingerprint <b>9EF0 C41A FBA5 64AA 650A  0259 9C6D CD17 283E 454C</b></p>
		<pre>
-----BEGIN PGP PUBLIC KEY BLOCK-----

mQQBBGBjDtIBH6DJa80zDBgR+VqlYGaXu5bEJg9HEgAtJeCLuThdhXfl5Zs32RyB
I1QjIlttvngepHQozmglBDmi2FZ4S+wWhZv10bZCoyXPIPwwq6TylwPv8+buxuff
B6tYil3VAB9XKGPyPjKrlXn1fz76VMpuTOs7OGYR8xDidw9EHfBvmb+sQyrU1FOW
aPHxba5lK6hAo/KYFpTnimsmsz0Cvo1sZAV/EFIkfagiGTL2J/NhINfGPScpj8LB
bYelVN/NU4c6Ws1ivWbfcGvqU4lymoJgJo/l9HiV6X2bdVyuB24O3xeyhTnD7laf
epykwxODVfAt4qLC3J478MSSmTXS8zMumaQMNR1tUUYtHCJC0xAKbsFukzbfoRDv
m2zFCCVxeYHvByxstuzg0SurlPyuiFiy2cENek5+W8Sjt95nEiQ4suBldswpz1Kv
n71t7vd7zst49xxExB+tD+vmY7GXIds43Rb05dqksQuo2yCeuCbY5RBiMHX3d4nU
041jHBsv5wY24j0N6bpAsm/s0T0Mt7IO6UaN33I712oPlclTweYTAesW3jDpeQ7A
ioi0CMjWZnRpUxorcFmzL/Cc/fPqgAtnAL5GIUuEOqUf8AlKmzsKcnKZ7L2d8mxG
QqN16nlAiUuUpchQNMr+tAa1L5S1uK/fu6thVlSSk7KMQyJfVpwLy6068a1WmNj4
yxo9HaSeQNXh3cui+61qb9wlrkwlaiouw9+bpCmR0V8+XpWma/D/TEz9tg5vkfNo
eG4t+FUQ7QgrrvIkDNFcRyTUO9cJHB+kcp2NgCcpCwan3wnuzKka9AWFAitpoAwx
L6BX0L8kg/LzRPhkQnMOrj/tuu9hZrui4woqURhWLiYi2aZe7WCkuoqR/qMGP6qP
EQRcvndTWkQo6K9BdCH4ZjRqcGbY1wFt/qgAxhi+uSo2IWiM1fRI4eRCGifpBtYK
Dw44W9uPAu4cgVnAUzESEeW0bft5XXxAqpvyMBIdv3YqfVfOElZdKbteEu4YuOao
FLpbk4ajCxO4Fzc9AugJ8iQOAoaekJWA7TjWJ6CbJe8w3thpznP0w6jNG8ZleZ6a
jHckyGlx5wzQTRLVT5+wK6edFlxKmSd93jkLWWCbrc0Dsa39OkSTDmZPoZgKGRhp
Yc0C4jePYreTGI6p7/H3AFv84o0fjHt5fn4GpT1Xgfg+1X/wmIv7iNQtljCjAqhD
6XN+QiOAYAloAym8lOm9zOoCDv1TSDpmeyeP0rNV95OozsmFAUaKSUcUFBUfq9FL
uyr+rJZQw2DPfq2wE75PtOyJiZH7zljCh12fp5yrNx6L7HSqwwuG7vGO4f0ltYOZ
dPKzaEhCOO7o108RexdNABEBAAG0Rldpa2lMZWFrcyBFZGl0b3JpYWwgT2ZmaWNl
IEhpZ2ggU2VjdXJpdHkgQ29tbXVuaWNhdGlvbiBLZXkgKDIwMjEtMjAyNCmJBDEE
EwEKACcFAmBjDtICGwMFCQWjmoAFCwkIBwMFFQoJCAsFFgIDAQACHgECF4AACgkQ
nG3NFyg+RUzRbh+eMSKgMYOdoz70u4RKTvev4KyqCAlwji+1RomnW7qsAK+l1s6b
ugOhOs8zYv2ZSy6lv5JgWITRZogvB69JP94+Juphol6LIImC9X3P/bcBLw7VCdNA
mP0XQ4OlleLZWXUEW9EqR4QyM0RkPMoxXObfRgtGHKIkjZYXyGhUOd7MxRM8DBzN
yieFf3CjZNADQnNBk/ZWRdJrpq8J1W0dNKI7IUW2yCyfdgnPAkX/lyIqw4ht5UxF
VGrva3PoepPir0TeKP3M0BMxpsxYSVOdwcsnkMzMlQ7TOJlsEdtKQwxjV6a1vH+t
k4TpR4aG8fS7ZtGzxcxPylhndiiRVwdYitr5nKeBP69aWH9uLcpIzplXm4DcusUc
Bo8KHz+qlIjs03k8hRfqYhUGB96nK6TJ0xS7tN83WUFQXk29fWkXjQSp1Z5dNCcT
sWQBTxWxwYyEI8iGErH2xnok3HTyMItdCGEVBBhGOs1uCHX3W3yW2CooWLC/8Pia
qgss3V7m4SHSfl4pDeZJcAPiH3Fm00wlGUslVSziatXW3499f2QdSyNDw6Qc+chK
hUFflmAaavtpTqXPk+Lzvtw5SSW+iRGmEQICKzD2chpy05mW5v6QUy+G29nchGDD
rrfpId2Gy1VoyBx8FAto4+6BOWVijrOj9Boz7098huotDQgNoEnidvVdsqP+P1RR
QJekr97idAV28i7iEOLd99d6qI5xRqc3/QsV+y2ZnnyKB10uQNVPLgUkQljqN0wP
XmdVer+0X+aeTHUd1d64fcc6M0cpYefNNRCsTsgbnWD+x0rjS9RMo+Uosy41+IxJ
6qIBhNrMK6fEmQoZG3qTRPYYrDoaJdDJERN2E5yLxP2SPI0rWNjMSoPEA/gk5L91
m6bToM/0VkEJNJkpxU5fq5834s3PleW39ZdpI0HpBDGeEypo/t9oGDY3Pd7JrMOF
zOTohxTyu4w2Ql7jgs+7KbO9PH0Fx5dTDmDq66jKIkkC7DI0QtMQclnmWWtn14BS
KTSZoZekWESVYhORwmPEf32EPiC9t8zDRglXzPGmJAPISSQz+Cc9o1ipoSIkoCCh
2MWoSbn3KFA53vgsYd0vS/+Nw5aUksSleorFns2yFgp/w5Ygv0D007k6u3DqyRLB
W5y6tJLvbC1ME7jCBoLW6nFEVxgDo727pqOpMVjGGx5zcEokPIRDMkW/lXjw+fTy
c6misESDCAWbgzniG/iyt77Kz711unpOhw5aemI9LpOq17AiIbjzSZYt6b1Aq7Wr
aB+C1yws2ivIl9ZYK911A1m69yuUg0DPK+uyL7Z86XC7hI8B0IY1MM/MbmFiDo6H
dkfwUckE74sxxeJrFZKkBbkEAQRgYw7SAR+gvktRnaUrj/84Pu0oYVe49nPEcy/7
5Fs6LvAwAj+JcAQPW3uy7D7fuGFEQguasfRrhWY5R87+g5ria6qQT2/Sf19Tpngs
d0Dd9DJ1MMTaA1pc5F7PQgoOVKo68fDXfjr76n1NchfCzQbozS1HoM8ys3WnKAw+
Neae9oymp2t9FB3B+To4nsvsOM9KM06ZfBILO9NtzbWhzaAyWwSrMOFFJfpyxZAQ
8VbucNDHkPJjhxuafreC9q2f316RlwdS+XjDggRY6xD77fHtzYea04UWuZidc5zL
VpsuZR1nObXOgE+4s8LU5p6fo7jL0CRxvfFnDhSQg2Z617flsdjYAJ2JR4apg3Es
G46xWl8xf7t227/0nXaCIMJI7g09FeOOsfCmBaf/ebfiXXnQbK2zCbbDYXbrYgw6
ESkSTt940lHtynnVmQBvZqSXY93MeKjSaQk1VKyobngqaDAIIzHxNCR941McGD7F
qHHM2YMTgi6XXaDThNC6u5msI1l/24PPvrxkJxjPSGsNlCbXL2wqaDgrP6LvCP9O
uooR9dVRxaZXcKQjeVGxrcRtoTSSyZimfjEercwi9RKHt42O5akPsXaOzeVjmvD9
EB5jrKBe/aAOHgHJEIgJhUNARJ9+dXm7GofpvtN/5RE6qlx11QGvoENHIgawGjGX
Jy5oyRBS+e+KHcgVqbmV9bvIXdwiC4BDGxkXtjc75hTaGhnDpu69+Cq016cfsh+0
XaRnHRdh0SZfcYdEqqjn9CTILfNuiEpZm6hYOlrfgYQe1I13rgrnSV+EfVCOLF4L
P9ejcf3eCvNhIhEjsBNEUDOFAA6J5+YqZvFYtjk3efpM2jCg6XTLZWaI8kCuADMu
yrQxGrM8yIGvBndrlmmljUqlc8/Nq9rcLVFDsVqb9wOZjrCIJ7GEUD6bRuolmRPE
SLrpP5mDS+wetdhLn5ME1e9JeVkiSVSFIGsumZTNUaT0a90L4yNj5gBE40dvFplW
7TLeNE/ewDQk5LiIrfWuTUn3CqpjIOXxsZFLjieNgofX1nSeLjy3tnJwuTYQlVJO
3CbqH1k6cOIvE9XShnnuxmiSoav4uZIXnLZFQRT9v8UPIuedp7TO8Vjl0xRTajCL
PdTk21e7fYriax62IssYcsbbo5G5auEdPO04H/+v/hxmRsGIr3XYvSi4ZWXKASxy
a/jHFu9zEqmy0EBzFzpmSx+FrzpMKPkoU7RbxzMgZwIYEBk66Hh6gxllL0JmWjV0
iqmJMtOERE4NgYgumQT3dTxKuFtywmFxBTe80BhGlfUbjBtiSrULq59np4ztwlRT
wDEAVDoZbN57aEXhQ8jjF2RlHtqGXhFMrg9fALHaRQARAQABiQQZBBgBCgAPBQJg
Yw7SAhsMBQkFo5qAAAoJEJxtzRcoPkVMdigfoK4oBYoxVoWUBCUekCg/alVGyEHa
ekvFmd3LYSKX/WklAY7cAgL/1UlLIFXbq9jpGXJUmLZBkzXkOylF9FIXNNTFAmBM
3TRjfPv91D8EhrHJW0SlECN+riBLtfIQV9Y1BUlQthxFPtB1G1fGrv4XR9Y4TsRj
VSo78cNMQY6/89Kc00ip7tdLeFUHtKcJs+5EfDQgagf8pSfF/TWnYZOMN2mAPRRf
fh3SkFXeuM7PU/X0B6FJNXefGJbmfJBOXFbaSRnkacTOE9caftRKN1LHBAr8/RPk
pc9p6y9RBc/+6rLuLRZpn2W3m3kwzb4scDtHHFXXQBNC1ytrqdwxU7kcaJEPOFfC
XIdKfXw9AQll620qPFmVIPH5qfoZzjk4iTH06Yiq7PI4OgDis6bZKHKyyzFisOkh
DXiTuuDnzgcu0U4gzL+bkxJ2QRdiyZdKJJMswbm5JDpX6PLsrzPmN314lKIHQx3t
NNXkbfHL/PxuoUtWLKg7/I3PNnOgNnDqCgqpHJuhU1AZeIkvewHsYu+urT67tnpJ
AK1Z4CgRxpgbYA4YEV1rWVAPHX1u1okcg85rc5FHK8zh46zQY1wzUTWubAcxqp9K
1IqjXDDkMgIX2Z2fOA1plJSwugUCbFjn4sbT0t0YuiEFMPMB42ZCjcCyA1yysfAd
DYAmSer1bq47tyTFQwP+2ZnvW/9p3yJ4oYWzwMzadR3T0K4sgXRC2Us9nPL9k2K5
TRwZ07wE2CyMpUv+hZ4ja13A/1ynJZDZGKys+pmBNrO6abxTGohM8LIWjS+YBPIq
trxh8jxzgLazKvMGmaA6KaOGwS8vhfPfxZsu2TJaRPrZMa/HpZ2aEHwxXRy4nm9G
Kx1eFNJO6Ues5T7KlRtl8gflI5wZCCD/4T5rto3SfG0s0jr3iAVb3NCn9Q73kiph
PSwHuRxcm+hWNszjJg3/W+Fr8fdXAh5i0JzMNscuFAQNHgfhLigenq+BpCnZzXya
01kqX24AdoSIbH++vvgE0Bjj6mzuRrH5VJ1Qg9nQ+yMjBWZADljtp3CARUbNkiIg
tUJ8IJHCGVwXZBqY4qeJc3h/RiwWM2UIFfBZ+E06QPznmVLSkwvvop3zkr4eYNez
cIKUju8vRdW6sxaaxC/GECDlP0Wo6lH0uChpE3NJ1daoXIeymajmYxNt+drz7+pd
jMqjDtNA2rgUrjptUgJK8ZLdOQ4WCrPY5pP9ZXAO7+mK7S3u9CTywSJmQpypd8hv
8Bu8jKZdoxOJXxj8CphK951eNOLYxTOxBUNB8J2lgKbmLIyPvBvbS1l1lCM5oHlw
WXGlp70pspj3kaX4mOiFaWMKHhOLb+er8yh8jspM184=
=5a6T
-----END PGP PUBLIC KEY BLOCK-----

		</pre>
	</div>
</div>

<div id="submit_help_contact" class="submit_elem">
	<div class="container">
		<div class="text-center"><div class="submit_buttons btn-group" role="group">
			<a href="#submit_help_contact" class="btn-wl">How to contact WikiLeaks?</a>
			<a href="#submit_help_tor" class="btn-wl btn-wl-empty">What is Tor?</a>
			<a href="#submit_help_tips" class="btn-wl btn-wl-empty">Tips for Sources</a>
			<a href="#submit_help_after" class="btn-wl btn-wl-empty">After Submitting</a>
		</div></div>

		<h3>Contact</h3>
		<p>If you need help using Tor you can contact WikiLeaks for assistance in setting it up using our simple webchat available at: <a href="https://wikileaks.org/talk">https://wikileaks.org/talk</a></p>
		<p>If you can use Tor, but need to contact WikiLeaks for other reasons use our secured webchat available at <b>http://wlchatc3pjwpli5r.onion</b></p>
		<p>We recommend contacting us over Tor if you can.</p>
	</div>
</div>

<div id="submit_help_tor" class="submit_elem">
	<div class="container">
		<div class="text-center"><div class="submit_buttons btn-group" role="group">
			<a href="#submit_help_contact" class="btn-wl btn-wl-empty">How to contact WikiLeaks?</a>
			<a href="#submit_help_tor" class="btn-wl">What is Tor?</a>
			<a href="#submit_help_tips" class="btn-wl btn-wl-empty">Tips for Sources</a>
			<a href="#submit_help_after" class="btn-wl btn-wl-empty">After Submitting</a>
		</div></div>

		<h3>Tor</h3>
		<p><a href="https://www.torproject.org">Tor</a> is an encrypted anonymising network that makes it harder to intercept internet communications, or see where communications are coming from or going to.</p>
		<p>In order to use the WikiLeaks public submission system as detailed above you can download the Tor Browser Bundle, which is a Firefox-like browser available for Windows, Mac OS X and GNU/Linux and pre-configured to connect using the anonymising system Tor.</p>
		<h4>Tails</h4>
		<p>If you are at high risk and you have the capacity to do so, you can also access the submission system through a secure operating system called <a href="https://tails.boum.org">Tails</a>. Tails is an operating system launched from a USB stick or a DVD that aim to leaves no traces when the computer is shut down after use and automatically routes your internet traffic through Tor. Tails will require you to have either a USB stick or a DVD at least 4GB big and a laptop or desktop computer.</p>
	</div>
</div>

<div id="submit_help_tips" class="submit_elem">
	<div class="container">
		<div class="text-center">
			<div class="submit_buttons btn-group" role="group">
				<a href="#submit_help_contact" class="btn-wl btn-wl-empty">How to contact WikiLeaks?</a>
				<a href="#submit_help_tor" class="btn-wl btn-wl-empty">What is Tor?</a>
				<a href="#submit_help_tips" class="btn-wl">Tips for Sources</a>
				<a href="#submit_help_after" class="btn-wl btn-wl-empty">After Submitting</a>
			</div>
		</div>

		<h3>Tips</h3>
		<p>Our submission system works hard to preserve your anonymity, but we recommend you also take some of your own precautions. Please review these basic guidelines. </p>
		<div>
			<h4>1. Contact us if you have specific problems</h4>
			<p>If you have a very large submission, or a submission with a complex format, or are a high-risk source, please <a href="#submit_help_contact">contact us</a>. In our experience it is always possible to find a custom solution for even the most seemingly difficult situations.</p>
		</div>
		<div>
			<h4>2. What computer to use</h4>
			<p>If the computer you are uploading from could subsequently be audited in an investigation, consider using a computer that is not easily tied to you. Technical users can also use <a href="https://tails.boum.org">Tails</a> to help ensure you do not leave any records of your submission on the computer.</p>
		</div>
		<div>
			<h4>3. Do not talk about your submission to others</h4>
			<p>If you have any issues talk to WikiLeaks. We are the global experts in source protection – it is a complex field. Even those who mean well often do not have the experience or expertise to advise properly. This includes other media organisations.</p>
		</div>

	</div>
</div>

<div id="submit_help_after" class="submit_elem">
	<div class="container">
		<div class="text-center">
			<div class="submit_buttons btn-group" role="group">
				<a href="#submit_help_contact" class="btn-wl btn-wl-empty">How to contact WikiLeaks?</a>
				<a href="#submit_help_tor" class="btn-wl btn-wl-empty">What is Tor?</a>
				<a href="#submit_help_tips" class="btn-wl btn-wl-empty">Tips for Sources</a>
				<a href="#submit_help_after" class="btn-wl">After Submitting</a>
			</div>
		</div>

		<h3>After</h3>

		<div>
			<h4>1. Do not talk about your submission to others</h4>
			<p>If you have any issues talk to WikiLeaks. We are the global experts in source protection – it is a complex field. Even those who mean well often do not have the experience or expertise to advise properly. This includes other media organisations.</p>
		</div>

		<div>
			<h4>2. Act normal</h4>
			<p>If you are a high-risk source, avoid saying anything or doing anything after submitting which might promote suspicion. In particular, you should try to stick to your normal routine and behaviour.</p>
		</div>

		<div>
			<h4>3. Remove traces of your submission</h4>
			<p>If you are a high-risk source and the computer you prepared your submission on, or uploaded it from, could subsequently be audited in an investigation, we recommend that you format and dispose of the computer hard drive and any other storage media you used.</p>
			<p>In particular, hard drives retain data after formatting which may be visible to a digital forensics team and flash media (USB sticks, memory cards and SSD drives) retain data even after a secure erasure. If you used flash media to store sensitive data, it is important to destroy the media.</p>
			<p>If you do this and are a high-risk source you should make sure there are no traces of the clean-up, since such traces themselves may draw suspicion.</p>
			<div>
				<h4>4. If you face legal action</h4>
				<p>If a legal action is brought against you as a result of your submission, there are organisations that may help you. The Courage Foundation is an international organisation dedicated to the protection of journalistic sources. You can find more details at <a href="https://www.couragefound.org">https://www.couragefound.org</a>.</p>
			</div>
		</div>
	</div>
</div>

<div id="submit" class="submit_banner">
	<div class="container">
		<div class="page-header">
			<h1>Submit documents to WikiLeaks</h1>
			<a class="remove-button" href="#"><span class="glyphicon glyphicon-remove-circle"></span></a>
		</div>
		<p>WikiLeaks publishes documents of political or historical importance that are censored or otherwise suppressed. We specialise in strategic global publishing and large archives.</p>
		<p>The following is the address of our secure site where you can anonymously upload your documents to WikiLeaks editors. You can only access this submissions system through Tor. (See our <a href="#submit_help_tor">Tor tab</a> for more information.) We also advise you to read our <a href="#submit_help_tips">tips for sources</a> before submitting.</p>

		<div class="alert alert-info">
			<div class="onion-url">http://rpzgejae7cxxst5vysqsijblti4duzn3kjsmn43ddi2l3jblhk4a44id.onion (<a href="https://wikileaks.org/verify-upload-address.txt">Verify</a>)</div>
			<!--<div>
				Copy this address into your Tor browser. Advanced users, if they wish, can also add a further layer of encryption to their submission using <a href="#submit_wlkey">our public PGP key</a>.
			</div>-->
		</div>

		<p>If you cannot use Tor, or your submission is very large, or you have specific requirements, WikiLeaks provides several alternative methods. <a href="#submit_help_contact">Contact us</a> to discuss how to proceed.</p>
	</div>
</div>
<div id="submit_help_buttons" class="submit_elem">
	<div class="container">
		<div class="text-center">
			<div class="submit_buttons btn-group" role="group">
				<a href="#submit_help_contact" class="btn-wl btn-wl-empty">How to contact WikiLeaks?</a>
				<a href="#submit_help_tor" class="btn-wl btn-wl-empty">What is Tor?</a>
				<a href="#submit_help_tips" class="btn-wl btn-wl-empty">Tips for Sources</a>
				<a href="#submit_help_after" class="btn-wl btn-wl-empty">After Submitting</a>
			</div>
		</div>
	</div>
</div>

  <div id="main">
        

<link href="/static/css/styles_topnav.css" rel="stylesheet">
<link href="/static/css/styles_sidenav.css" rel="stylesheet">
<div class="top-navigation">
  <nav class="navbar">
      <a href="#menu" class="mobile-only hot-dog nav-element">
      </a>
    <div class="nav-logo">
      <a href="https://wikileaks.org">
        <h1>WikiLeaks</h1>
      </a>
    </div>
    <div class="action-buttons">
      <a class="button-face support-link" href="https://wikileaks.shop/" target="_blank">Shop</a>
      <a class="button-face donate-link" href="https://shop.wikileaks.org/donate">Donate</a>
      <a class="button-face submit-link" href="#submit">Submit</a>
    </div>
    <form class="global-search" method="get" action="https://search.wikileaks.org/">
      <input type="text" name="q" placeholder="Search">
      <button class="btn-search" type="submit"></button>
    </form>
    <div class="main-nav">

        <ul class="first-level">

            <li>
              <a class=" leaks-menu-item" href="https://wikileaks.org/-Leaks-.html">Leaks</a>
            </li>

            <li>
              <a class=" news-menu-item" href="https://wikileaks.org/-News-.html">News</a>
            </li>

            <li>
              <a class=" about-menu-item" href="https://wikileaks.org/What-is-WikiLeaks.html">About</a>
            </li>

            <li>
              <a class=" partners-menu-item" href="https://wikileaks.org/-Partners-.html">Partners</a>
            </li>

        </ul>

    </div>
  </nav>
</div>

<nav id="menu" class="side-nav rub">
  <div class="menu-wrapper">
    <a class="close-btn nav-element" href="#"></a>

      <ul class="first-level">

            <li>
              <a class=" leaks-menu-item" href="https://wikileaks.org/-Leaks-.html">Leaks</a>
            </li>

            <li>
              <a class=" news-menu-item" href="https://wikileaks.org/-News-.html">News</a>
            </li>

            <li>
              <a class=" about-menu-item" href="https://wikileaks.org/What-is-WikiLeaks.html">About</a>

          </li>

          <li>
            <a class=" partners-menu-item" href="https://wikileaks.org/-Partners-.html">Partners</a>

          </li>

      </ul>

    <aside class="friends mobile-only">

        <ul class="first-level">
                <li>
                <a href="https://our.wikileaks.org" target="_blank">our.wikileaks.org</a>
                </li>
                <li>
                <a href="https://www.torproject.org/" target="_blank">Tor Project</a>
                </li>
                <li>
                <a href="https://tails.boum.org/" target="_blank">Tails</a>
                </li>
                <li>
                <a href="https://www.couragefound.org/" target="_blank">Courage</a>
                </li>
                <li>
                <a href="https://www.bitcoin.org/" target="_blank">Bitcoin</a>
                </li>
        
        </ul>

    </aside>
    <aside class="social mobile-only">
      <ul>
        <li>
          <a href="https://www.facebook.com/wikileaks" class="nav-element" target="_blank" alt="Facebook">
            <img class="img-responsive" src="/static/img/fb-logo.png" alt="Facebook" title="Facebook page" />
          </a>
        </li>
        <li>
          <a href="https://twitter.com/wikileaks" class="nav-element" target="_blank" alt="Twitter">
            <img class="img-responsive" src="/static/img/twitter-logo.png" alt="Twitter" title="Twitter page" />
          </a>
        </li>
      </ul>
    </aside>
  </div>
</nav>


    <div class="content">
      <div class="leak-header">
        <div class="title-area">
          <h1 class="leak-title">Vault 7: Projects</h1>
          <img src="./logo@400.png"/>
        </div>
        <div>
          <p>This publication series is about specific projects related to the
          <a href="https://wikileaks.org/ciav7p1/">Vault 7</a> main publication.</p>
        </div>
        <ul class="leak-navigation">
          
          
            
              
              <a href="./releases/">
                
                <li class="active">Releases</li>
              </a>
            
          
            
              
              <a href="./document/">
                
                <li>Documents</li>
              </a>
            
          
            
          
            
          
        </ul>
      </div>
      
  <div class="release-index">
      <h1>All Releases</h1>
      <ul>
        
          <li>
            <a href="#Protego">Protego</a>
            - 7 September, 2017
          </li>
        
          <li>
            <a href="#Angelfire">Angelfire</a>
            - 31 August, 2017
          </li>
        
          <li>
            <a href="#ExpressLane">ExpressLane</a>
            - 24 August, 2017
          </li>
        
          <li>
            <a href="#CouchPotato">CouchPotato</a>
            - 10 August, 2017
          </li>
        
          <li>
            <a href="#Dumbo">Dumbo</a>
            - 3 August, 2017
          </li>
        
          <li>
            <a href="#Imperial">Imperial</a>
            - 27 July, 2017
          </li>
        
          <li>
            <a href="#UCL / Raytheon">UCL / Raytheon</a>
            - 19 July, 2017
          </li>
        
          <li>
            <a href="#Highrise">Highrise</a>
            - 13 July, 2017
          </li>
        
          <li>
            <a href="#BothanSpy">BothanSpy</a>
            - 6 July, 2017
          </li>
        
          <li>
            <a href="#OutlawCountry">OutlawCountry</a>
            - 30 June, 2017
          </li>
        
          <li>
            <a href="#Elsa">Elsa</a>
            - 28 June, 2017
          </li>
        
          <li>
            <a href="#Brutal Kangaroo">Brutal Kangaroo</a>
            - 22 June, 2017
          </li>
        
          <li>
            <a href="#Cherry Blossom">Cherry Blossom</a>
            - 15 June, 2017
          </li>
        
          <li>
            <a href="#Pandemic">Pandemic</a>
            - 1 June, 2017
          </li>
        
          <li>
            <a href="#Athena">Athena</a>
            - 19 May, 2017
          </li>
        
          <li>
            <a href="#AfterMidnight">AfterMidnight</a>
            - 12 May, 2017
          </li>
        
          <li>
            <a href="#Archimedes">Archimedes</a>
            - 5 May, 2017
          </li>
        
          <li>
            <a href="#Scribbles">Scribbles</a>
            - 28 April, 2017
          </li>
        
          <li>
            <a href="#Weeping Angel">Weeping Angel</a>
            - 21 April, 2017
          </li>
        
          <li>
            <a href="#Hive">Hive</a>
            - 14 April, 2017
          </li>
        
          <li>
            <a href="#Grasshopper">Grasshopper</a>
            - 7 April, 2017
          </li>
        
          <li>
            <a href="#Marble Framework">Marble Framework</a>
            - 31 March, 2017
          </li>
        
          <li>
            <a href="#Dark Matter">Dark Matter</a>
            - 23 March, 2017
          </li>
        
      </ul>
  </div>

  <div class="releases">
    
      <div id="Protego" class="release">
        <h1>Protego</h1>
        <div class="date">
          7 September, 2017
          
        </div>

        <div class="leak-content">
          <p>Today, September 7th 2017, WikiLeaks publishes four secret documents from the <em>Protego</em> project of the CIA, along with 37 related documents (proprietary hardware/software manuals from <a href="https://www.microchip.com/" target="_blank">Microchip Technology Inc.</a>). The project was maintained between 2014 and 2015.</p>
<p><em>Protego</em> is not the "usual" malware development project like all previous publications by WikiLeaks in the <a href="https://wikileaks.org/ciav7p1/" target="_blank">Vault7</a> <a href="https://wikileaks.org/vault7/" target="_blank">series</a>. Indeed there is no explicit indication why it is part of the project repositories of the CIA/EDG at all.</p>
<p>The <em>Protego</em> project is a <a href="https://en.wikipedia.org/wiki/PIC_microcontroller" target="_blank">PIC</a>-based missile control system that was developed by <a href="http://www.raytheon.com/" target="_blank">Raytheon</a>. The documents indicate that the system is installed on-board a <a href="https://en.wikipedia.org/wiki/Pratt_%26_Whitney" target="_blank">Pratt & Whitney</a> aircraft (PWA) equipped with missile launch systems (air-to-air and/or air-to-ground).</p>
<p><em>Protego</em> consists of separate micro-controller units that exchange data and signals over encrypted and authenticated channels:</p>
<p>&nbsp;&nbsp;&raquo; On-board TWA are the 'Master Processor' (MP) and the 'Deployment Box'. Both systems are layed-out with master/slave redundancy.</p>
<p>&nbsp;&nbsp;&raquo; The missle system has micro-controllers for the missle itself ('Missle Smart Switch', MSS), the tube ('Tube Smart Switch', TSS) and the collar (which holds the missile before and at launch time).</p>
<p>The MP unit receives three signals from a beacon: 'In Border' (PWA is within the defined area of an operation), 'Valid GPS' (GPS signal available) and 'No End of Operational Period' (current time is within the defined timeframe for an operation). Missiles can only be launched if all signals received by MP are set to 'true'. Similary safeguards are in place to auto-destruct encryption and authentication keys for various scenarios (like 'leaving a target area of operation' or 'missing missle').</p>

          
        </div>

        
        <div class="leak-sidebar">
          
    <h2>Leaked Documents</h2>
  
  <div class="sidebar-section">
  
    <div class="sidebar-item">
      <a href="./document/Protego_Release_01_05-Design_Docs-20141009-System_HW_Description/"/>
        <img src="./img/document.png"/>
        Protego Release 01.05 -- System HW Description
      </a>
    </div>
    <br/>
    
  
    <div class="sidebar-item">
      <a href="./document/Protego_Release_01_05-Protego_Build_Procedure/"/>
        <img src="./img/document.png"/>
        Protego Release 01.05 -- Build Procedure
      </a>
    </div>
    <br/>
    
  
    <div class="sidebar-item">
      <a href="./document/Protego_Release-01_05-Design_Docs-20150809-Protego_Message_Format/"/>
        <img src="./img/document.png"/>
        Protego Release 01.05 -- Message Format
      </a>
    </div>
    <br/>
    
  
    <div class="sidebar-item">
      <a href="./document/Protego_Release_01_05-Protego-SW-SCRs-Release-01_05/"/>
        <img src="./img/document.png"/>
        Protego Release 01.05 -- SW SCRs
      </a>
    </div>
    <br/>
    
  
  </div>

          
  <div class="sidebar-section">
  
  </div>
        </div>
      </div>
    
      <div id="Angelfire" class="release">
        <h1>Angelfire</h1>
        <div class="date">
          31 August, 2017
          
        </div>

        <div class="leak-content">
          <p>Today, August 31st 2017, WikiLeaks publishes documents from the <em>Angelfire</em> project of the CIA. <em>Angelfire</em> is an implant comprised of five components: Solartime, <em>Wolfcreek</em>, Keystone (previously MagicWand), <em>BadMFS</em>, and the Windows Transitory File system. Like previously published CIA projects (<a href="https://wikileaks.org/vault7/grasshopper/" target="_blank">Grasshopper</a> and <a href="https://wikileaks.org/vault7/#AfterMidnight" target="_blank">AfterMidnight</a>) in the <a href="https://wikileaks.org/ciav7p1/" target="_blank">Vault7</a> <a href="#">series</a>, it is a persistent framework that can load and execute custom implants on target computers running the Microsoft Windows operating system (XP or Win7).</p>
<p>Solartime modifies the partition boot sector so that when Windows loads boot time device drivers, it also loads and executes the <em>Wolfcreek</em> implant, that once executed, can load and run other <em>Angelfire</em> implants. According to the documents, the loading of additional implants creates memory leaks that can be possibly detected on infected machines.</p>
<p>Keystone is part of the <em>Wolfcreek</em> implant and responsible for starting malicious user applications. Loaded implants never touch the file system, so there is very little forensic evidence that the process was ever ran. It always disguises as "C:\Windows\system32\svchost.exe" and can thus be detected in the Windows task manager, if the operating system is installed on another partition or in a different path.</p>
<p><em>BadMFS</em> is a library that implements a covert file system that is created at the end of the active partition (or in a file on disk in later versions). It is used to store all drivers and implants that <em>Wolfcreek</em> will start. All files are both encrypted and obfuscated to avoid string or PE header scanning. Some versions of <em>BadMFS</em> can be detected because the reference to the covert file system is stored in a file named "zf".</p>
<p>The Windows Transitory File system is the new method of installing <em>AngelFire</em>. Rather than lay independent components on disk, the system allows an operator to create transitory files for specific actions including installation, adding files to <em>AngelFire</em>, removing files from <em>AngelFire</em>, etc. Transitory files are added to the 'UserInstallApp'.</p>

          
        </div>

        
        <div class="leak-sidebar">
          
    <h2>Leaked Documents</h2>
  
  <div class="sidebar-section">
  
    <div class="sidebar-item">
      <a href="./document/Angelfire-2_0-UserGuide/"/>
        <img src="./img/document.png"/>
        Angelfire 2.0 -- User Guide
      </a>
    </div>
    <br/>
    
  
    <div class="sidebar-item">
      <a href="./document/BadMFS_Developer_Guide/"/>
        <img src="./img/document.png"/>
        BadMFS -- Developer Guide
      </a>
    </div>
    <br/>
    
  
    <div class="sidebar-item">
      <a href="./document/Wolfcreek-Docs-Angelfire_UserGuide/"/>
        <img src="./img/document.png"/>
        Wolfcreek Docs -- Angelfire User Guide
      </a>
    </div>
    <br/>
    
  
    <div class="sidebar-item">
      <a href="./document/Wolfcreek-Docs-Angelfire_test_matrix/"/>
        <img src="./img/document.png"/>
        Wolfcreek Docs -- Angelfire Test Matrix
      </a>
    </div>
    <br/>
    
  
    <div class="sidebar-item">
      <a href="./document/Wolfcreek-Docs-Notes/"/>
        <img src="./img/document.png"/>
        Wolfcreek Docs -- Notes
      </a>
    </div>
    <br/>
    
      <div class="sidebar-item">
        <a href="./document#angelfire">See more</a>
      </div>
    
  
  </div>

          
  <div class="sidebar-section">
  
  </div>
        </div>
      </div>
    
      <div id="ExpressLane" class="release">
        <h1>ExpressLane</h1>
        <div class="date">
          24 August, 2017
          
        </div>

        <div class="leak-content">
          <p>Today, August 24th 2017, WikiLeaks publishes secret documents from the <em>ExpressLane</em> project of the CIA. These documents show one of the cyber operations the CIA conducts against liaison services -- which includes among many others the National Security Agency (NSA),  the Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI).</p>
<p>The OTS (<a href="https://en.wikipedia.org/wiki/Office_of_Technical_Service" target="_blank">Office of Technical Services</a>), a branch within the CIA, has a biometric collection system that is provided to liaison services around the world -- with the expectation for sharing of the biometric takes collected on the systems. But this 'voluntary sharing' obviously does not work or is considered insufficient by the CIA, because <em>ExpressLane</em> is a covert information collection tool that is used by the CIA to secretly exfiltrate data collections from such systems provided to liaison services.</p>
<p><em>ExpressLane</em> is installed and run with the cover of upgrading the biometric software by OTS agents that visit the liaison sites. Liaison officers overseeing this procedure will remain unsuspicious, as the data exfiltration disguises behind a Windows installation splash screen.</p>
<p>The core components of the OTS system are based on products from <a href="https://www.crossmatch.com/" target="_blank">Cross Match</a>, a US company specializing in biometric software for law enforcement and the Intelligence Community. The company hit the headlines in 2011 when it was reported that the US military <a href="http://www.homelandsecuritynewswire.com/cross-matchs-seek-ii-may-have-identified-bin-laden" target="_blank">used a Cross Match product to identify Osama bin Laden</a> during the assassination operation in Pakistan.</p>

          
        </div>

        
        <div class="leak-sidebar">
          
    <h2>Leaked Documents</h2>
  
  <div class="sidebar-section">
  
    <div class="sidebar-item">
      <a href="./document/ExpressLane-3_1_1-TDR-2009-05-04/"/>
        <img src="./img/document.png"/>
        ExpressLane v3.1.1 -- Tool Delivery Review
      </a>
    </div>
    <br/>
    
  
    <div class="sidebar-item">
      <a href="./document/ExpressLane-3_1_1-TPP-FINAL/"/>
        <img src="./img/document.png"/>
        ExpressLane v3.1.1 -- TPP FINAL
      </a>
    </div>
    <br/>
    
  
    <div class="sidebar-item">
      <a href="./document/ExpressLane-3_1_1-User_Manual-Rev_New_2009-04-06/"/>
        <img src="./img/document.png"/>
        ExpressLane v3.1.1 -- User Manual
      </a>
    </div>
    <br/>
    
  
    <div class="sidebar-item">
      <a href="./document/ExpressLane-3_1_1-Requirement-Statement/"/>
        <img src="./img/document.png"/>
        ExpressLane v3.1.1 -- Requirement Statement
      </a>
    </div>
    <br/>
    
  
    <div class="sidebar-item">
      <a href="./document/ExpressLane-3_0-User_Guide/"/>
        <img src="./img/document.png"/>
        ExpressLane v3.0 -- User Guide
      </a>
    </div>
    <br/>
    
      <div class="sidebar-item">
        <a href="./document#expresslane">See more</a>
      </div>
    
  
  </div>

          
  <div class="sidebar-section">
  
  </div>
        </div>
      </div>
    
      <div id="CouchPotato" class="release">
        <h1>CouchPotato</h1>
        <div class="date">
          10 August, 2017
          
        </div>

        <div class="leak-content">
          <p>Today, August 10th 2017, WikiLeaks publishes the the User Guide for the <em>CoachPotato</em> project of the CIA. <em>CouchPotato</em> is a remote tool for collection against RTSP/H.264 video streams. It provides the ability to collect either the stream as a video file (AVI) or capture still images (JPG) of frames from the stream that are of significant change from a previously  captured frame. It utilizes ffmpeg for video and image encoding and decoding 
as well as RTSP connectivity.  <em>CouchPotato</em> relies on being launched in an ICE v3 Fire and Collect 
compatible loader.</p>

          
        </div>

        
        <div class="leak-sidebar">
          
    <h2>Leaked Documents</h2>
  
  <div class="sidebar-section">
  
    <div class="sidebar-item">
      <a href="./document/Couch_Potato-1_0-User_Guide/"/>
        <img src="./img/document.png"/>
        CouchPotato v1.0 -- User Guide
      </a>
    </div>
    <br/>
    
  
  </div>

          
  <div class="sidebar-section">
  
  </div>
        </div>
      </div>
    
      <div id="Dumbo" class="release">
        <h1>Dumbo</h1>
        <div class="date">
          3 August, 2017
          
        </div>

        <div class="leak-content">
          <p>Today, August 3rd 2017 WikiLeaks publishes documents from the <em>Dumbo</em> project of the CIA. <em>Dumbo</em> is a capability to suspend processes utilizing webcams and corrupt any video recordings that could compromise a PAG deployment. The PAG (Physical Access Group) is a special branch within the CCI (Center for Cyber Intelligence); its task is to gain and exploit physical access to target computers in CIA field operations.</p>
<p><em>Dumbo</em> can identify, control and manipulate monitoring and detection systems on a target computer running the Microsoft Windows operating sytem. It identifies installed devices like webcams and microphones, either locally or connected by wireless (Bluetooth, WiFi) or wired networks. All processes related to the detected devices (usually recording, monitoring or detection of video/audio/network streams) are also identified and can be stopped by the operator. By deleting or manipulating recordings the operator is aided in creating fake or destroying actual evidence of the intrusion operation.</p>
<p><em>Dumbo</em> is run by the field agent directly from an USB stick; it requires administrator privileges to perform its task. It supports 32bit Windows XP, Windows Vista, and newer versions of Windows operating system. 64bit Windows XP, or Windows versions prior to XP are not supported.</p>

          
        </div>

        
        <div class="leak-sidebar">
          
    <h2>Leaked Documents</h2>
  
  <div class="sidebar-section">
  
    <div class="sidebar-item">
      <a href="./document/Dumbo-v3_0-Field_Guide/"/>
        <img src="./img/document.png"/>
        Dumbo v3.0 -- Field Guide
      </a>
    </div>
    <br/>
    
  
    <div class="sidebar-item">
      <a href="./document/Dumbo-v3_0-User_Guide/"/>
        <img src="./img/document.png"/>
        Dumbo v3.0 -- User Guide
      </a>
    </div>
    <br/>
    
  
    <div class="sidebar-item">
      <a href="./document/Dumbo-v2_0-Field_Guide/"/>
        <img src="./img/document.png"/>
        Dumbo v2.0 -- Field Guide
      </a>
    </div>
    <br/>
    
  
    <div class="sidebar-item">
      <a href="./document/Dumbo-v2_0-User_Guide/"/>
        <img src="./img/document.png"/>
        Dumbo v2.0 -- User Guide
      </a>
    </div>
    <br/>
    
  
    <div class="sidebar-item">
      <a href="./document/Dumbo-V1_0-TDR-Briefing-2012/"/>
        <img src="./img/document.png"/>
        Dumbo v1.0 -- TDR Briefing
      </a>
    </div>
    <br/>
    
      <div class="sidebar-item">
        <a href="./document#dumbo">See more</a>
      </div>
    
  
  </div>

          
  <div class="sidebar-section">
  
  </div>
        </div>
      </div>
    
      <div id="Imperial" class="release">
        <h1>Imperial</h1>
        <div class="date">
          27 July, 2017
          
        </div>

        <div class="leak-content">
          <p>Today, July 27th 2017, WikiLeaks publishes documents from the <em>Imperial</em> project of the CIA.</p>
<p><em>Achilles</em> is a capability that provides an operator the ability to trojan an OS X disk image (.dmg) installer with one or more desired operator specified executables for a one-time execution.</p>
<p><em>Aeris</em> is an automated implant written in C that supports a number of POSIX-based systems (Debian, RHEL, Solaris, FreeBSD, CentOS). It supports automated file exfiltration, configurable beacon interval and jitter, standalone and Collide-based HTTPS LP support and SMTP protocol support - all with TLS encrypted communications with mutual authentication. It is compatible with the NOD Cryptographic Specification and provides structured command and control that is similar to that used by several Windows implants.</p>
<p><em>SeaPea</em> is an OS X Rootkit that provides stealth and tool launching capabilities. It hides files/directories, socket connections and/or processes. It runs on Mac OSX 10.6 and 10.7.</p>

          
        </div>

        
        <div class="leak-sidebar">
          
    <h2>Leaked Documents</h2>
  
  <div class="sidebar-section">
  
    <div class="sidebar-item">
      <a href="./document/Achilles-UserGuide/"/>
        <img src="./img/document.png"/>
        Achilles -- User Guide
      </a>
    </div>
    <br/>
    
  
    <div class="sidebar-item">
      <a href="./document/SeaPea-User_Guide/"/>
        <img src="./img/document.png"/>
        SeaPea -- User Guide
      </a>
    </div>
    <br/>
    
  
    <div class="sidebar-item">
      <a href="./document/Aeris-UsersGuide/"/>
        <img src="./img/document.png"/>
        Aeris -- Users Guide
      </a>
    </div>
    <br/>
    
  
  </div>

          
  <div class="sidebar-section">
  
  </div>
        </div>
      </div>
    
      <div id="UCL / Raytheon" class="release">
        <h1>UCL / Raytheon</h1>
        <div class="date">
          19 July, 2017
          
        </div>

        <div class="leak-content">
          <p>Today, July 19th 2017, WikiLeaks publishes documents from the CIA contractor <em>Raytheon Blackbird Technologies</em> for the "<a href="https://wikileaks.org/ciav7p1/cms/page_2621751.html" target="_blank">UMBRAGE</a> Component Library" (UCL) project. The documents were submitted to the CIA between November 21<sup>st</sup>, 2014 (just two weeks after <a href="http://investor.raytheon.com/phoenix.zhtml?c=84193&p=irol-newsArticle&ID=1985908" target="_blank">Raytheon acquired Blackbird Technologies</a> to build a <a href="http://www.raytheon.com/news/feature/cyber_powerhouse.html" target="_blank">Cyber Powerhouse</a>)  and September 11<sup>th</sup>, 2015. They mostly contain Proof-of-Concept ideas and assessments for malware attack vectors - partly based on public documents from security researchers and private enterprises in the computer security field.</p>
<p><em>Raytheon Blackbird Technologies</em> acted as a kind of "technology scout" for the <a href="https://wikileaks.org/ciav7p1/cms/space_753668.html" target="_blank">Remote Development Branch (RDB)</a> of the CIA by analysing malware attacks in the wild and giving recommendations to the CIA development teams for further investigation and PoC development for their own malware projects.</p>

          
        </div>

        
        <div class="leak-sidebar">
          
    <h2>Leaked Documents</h2>
  
  <div class="sidebar-section">
  
    <div class="sidebar-item">
      <a href="./document/2015-09-20150911-279-CSIT-15083-HTTPBrowser/"/>
        <img src="./img/document.png"/>
        (S//NF) CSIT 15083 -- HTTPBrowser
      </a>
    </div>
    <br/>
    
  
    <div class="sidebar-item">
      <a href="./document/2015-09-20150911-280-CSIT-15085-NfLog/"/>
        <img src="./img/document.png"/>
        (S//NF) CSIT 15085 -- NfLog
      </a>
    </div>
    <br/>
    
  
    <div class="sidebar-item">
      <a href="./document/2015-09-20150911-276-Symantec-Regin/"/>
        <img src="./img/document.png"/>
        (S//NF) Symantec -- Regin - Stealthy Surveillance
      </a>
    </div>
    <br/>
    
  
    <div class="sidebar-item">
      <a href="./document/2015-09-20150911-277-FireEye-HammerToss/"/>
        <img src="./img/document.png"/>
        (S//NF) FireEye -- HammerToss - Stealthy Tactics
      </a>
    </div>
    <br/>
    
  
    <div class="sidebar-item">
      <a href="./document/2015-09-20150911-278-VB-Gamker/"/>
        <img src="./img/document.png"/>
        (S//NF) VB -- Gamker
      </a>
    </div>
    <br/>
    
      <div class="sidebar-item">
        <a href="./document#raytheon">See more</a>
      </div>
    
  
  </div>

          
  <div class="sidebar-section">
  
  </div>
        </div>
      </div>
    
      <div id="Highrise" class="release">
        <h1>Highrise</h1>
        <div class="date">
          13 July, 2017
          
        </div>

        <div class="leak-content">
          <p>Today, July 13th 2017, WikiLeaks publishes documents from the <em>Highrise</em> project of the CIA. <em>HighRise</em> is an Android application designed for mobile devices running Android 4.0 to 4.3. It provides a redirector function for SMS messaging that could be used by a number of IOC tools that use SMS messages for communication between implants and listening posts. <em>HighRise</em> acts as a SMS proxy that provides greater separation between devices in the field ("targets") and the listening post (LP) by proxying "incoming" and "outgoing" SMS messages to an internet LP. <em>Highrise</em> provides a communications channel between the <em>HighRise</em> field operator and the LP with a TLS/SSL secured internet communication.</p>

          
        </div>

        
        <div class="leak-sidebar">
          
    <h2>Leaked Documents</h2>
  
  <div class="sidebar-section">
  
    <div class="sidebar-item">
      <a href="./document/HighRise-2_0-Users_Guide/"/>
        <img src="./img/document.png"/>
        HighRise 2.0 Users Guide
      </a>
    </div>
    <br/>
    
  
  </div>

          
  <div class="sidebar-section">
  
  </div>
        </div>
      </div>
    
      <div id="BothanSpy" class="release">
        <h1>BothanSpy</h1>
        <div class="date">
          6 July, 2017
          
        </div>

        <div class="leak-content">
          <p>Today, July 6th 2017, WikiLeaks publishes documents from the <em>BothanSpy</em> and <em>Gyrfalcon</em> projects of the CIA. The implants described in both projects are designed to intercept and exfiltrate SSH credentials but work on different operating systems with different attack vectors.</p>
<p><em>BothanSpy</em> is an implant that targets the SSH client program Xshell on the Microsoft Windows platform and steals user credentials for all active SSH sessions. These credentials are either username and password in case of password-authenticated SSH sessions or username, filename of private SSH key and key password if public key authentication is used. <em>BothanSpy</em> can exfiltrate the stolen credentials to a CIA-controlled server (so the implant never touches the disk on the target system) or save it in an enrypted file for later exfiltration by other means. <em>BothanSpy</em> is installed as a Shellterm 3.x extension on the target machine.</p>
<p><em>Gyrfalcon</em> is an implant that targets the OpenSSH client on Linux platforms (centos,debian,rhel,suse,ubuntu). The implant can not only steal user credentials of active SSH sessions, but is also capable of collecting full or partial OpenSSH session traffic. All collected information is stored in an encrypted file for later exfiltration. It is installed and configured by using a CIA-developed root kit (JQC/KitV) on the target machine.</p>

          
        </div>

        
        <div class="leak-sidebar">
          
    <h2>Leaked Documents</h2>
  
  <div class="sidebar-section">
  
    <div class="sidebar-item">
      <a href="./document/BothanSpy_1_0-S-NF/"/>
        <img src="./img/document.png"/>
        BothanSpy 1.0
      </a>
    </div>
    <br/>
    
  
    <div class="sidebar-item">
      <a href="./document/Gyrfalcon-2_0-User_Guide/"/>
        <img src="./img/document.png"/>
        Gyrfalcon 2.0 User Guide
      </a>
    </div>
    <br/>
    
  
    <div class="sidebar-item">
      <a href="./document/Gyrfalcon-1_0-User_Manual/"/>
        <img src="./img/document.png"/>
        Gyrfalcon 1.0 User Manual
      </a>
    </div>
    <br/>
    
  
  </div>

          
  <div class="sidebar-section">
  
  </div>
        </div>
      </div>
    
      <div id="OutlawCountry" class="release">
        <h1>OutlawCountry</h1>
        <div class="date">
          30 June, 2017
          
        </div>

        <div class="leak-content">
          <p>Today, June 30th 2017, WikiLeaks publishes documents from the <em>OutlawCountry</em> project of the CIA that targets computers running the Linux operating system. <em>OutlawCountry</em> allows for the redirection of all outbound network traffic on the target computer to CIA controlled machines for ex- and infiltration purposes. The malware consists of a kernel module that creates a hidden netfilter table on a Linux target; with knowledge of the table name, an operator can create rules that take precedence over existing netfilter/iptables rules and are concealed from an user or even system administrator.</p>
<p>The installation and persistence method of the malware is not described in detail in the document; an operator will have to rely on the available CIA exploits and backdoors to inject the kernel module into a target operating system. <em>OutlawCountry</em> v1.0 contains one kernel module for 64-bit CentOS/RHEL 6.x; this module will only work with default kernels. Also, <em>OutlawCountry</em> v1.0 only supports adding covert DNAT rules to the PREROUTING chain.</p>

          
        </div>

        
        <div class="leak-sidebar">
          
    <h2>Leaked Documents</h2>
  
  <div class="sidebar-section">
  
    <div class="sidebar-item">
      <a href="./document/OutlawCountry_v1_0_User_Manual/"/>
        <img src="./img/document.png"/>
        OutlawCountry v1.0 User Manual
      </a>
    </div>
    <br/>
    
  
    <div class="sidebar-item">
      <a href="./document/OutlawCountry_v1_0_Test_Plan/"/>
        <img src="./img/document.png"/>
        OutlawCountry v1.0 Test Plan
      </a>
    </div>
    <br/>
    
  
  </div>

          
  <div class="sidebar-section">
  
  </div>
        </div>
      </div>
    
      <div id="Elsa" class="release">
        <h1>Elsa</h1>
        <div class="date">
          28 June, 2017
          
        </div>

        <div class="leak-content">
          <p>Today, June 28th 2017, WikiLeaks publishes documents from the <em>ELSA</em> project of the CIA. <em>ELSA</em> is a geo-location malware for WiFi-enabled devices like laptops running the Micorosoft Windows operating system. Once persistently installed on a target machine using separate CIA exploits, the malware scans visible WiFi access points and records the ESS identifier, MAC address and signal strength at regular intervals. To perform the data collection the target machine does not have to be online or connected to an access point; it only needs to be running with an enabled WiFi device. If it is connected to the internet, the malware automatically tries to use public geo-location databases from Google or Microsoft to resolve the position of the device and stores the longitude and latitude data along with the timestamp. The collected access point/geo-location information is stored in encrypted form on the device for later exfiltration. The malware itself does not beacon this data to a CIA back-end; instead the operator must actively retrieve the log file from the device - again using separate CIA exploits and backdoors.</p>
<p>The <em>ELSA</em> project allows the customization of the implant to match the target environment and operational objectives like sampling interval, maximum size of the logfile and invocation/persistence method.  Additional back-end software (again using public geo-location databases from Google and Microsoft) converts unprocessed access point information from exfiltrated logfiles to geo-location data to create a tracking profile of the target device.</p>

          
        </div>

        
        <div class="leak-sidebar">
          
    <h2>Leaked Documents</h2>
  
  <div class="sidebar-section">
  
    <div class="sidebar-item">
      <a href="./document/Elsa_User_Manual/"/>
        <img src="./img/document.png"/>
        ELSA User Manual
      </a>
    </div>
    <br/>
    
  
  </div>

          
  <div class="sidebar-section">
  
  </div>
        </div>
      </div>
    
      <div id="Brutal Kangaroo" class="release">
        <h1>Brutal Kangaroo</h1>
        <div class="date">
          22 June, 2017
          
        </div>

        <div class="leak-content">
          <p>Today, June 22nd 2017, WikiLeaks publishes documents from the <em>Brutal Kangaroo</em> project of the CIA. <em>Brutal Kangaroo</em> is a tool suite for Microsoft Windows that targets closed networks by air gap jumping using thumbdrives. <em>Brutal Kangaroo</em> components create a custom covert network within the target closed network and providing functionality for executing surveys, directory listings, and arbitrary executables.</p>
<p>The documents describe how a CIA operation can infiltrate a closed network (or a single air-gapped computer) within an organization or enterprise without direct access. It first infects a Internet-connected computer within the organization (referred to as "primary host")  and installs the <em>BrutalKangeroo</em> malware on it. When a user is using the primary host and inserts a USB stick into it, the thumbdrive itself is infected with a separate malware. If this thumbdrive is used to copy data between the closed network and the LAN/WAN, the user will sooner or later plug the USB disk into a computer on the closed network. By browsing the USB drive with Windows Explorer on such a protected computer, it also gets infected with exfiltration/survey malware. If multiple computers on the closed network are under CIA control, they form a covert network to coordinate tasks and data exchange. Although not explicitly stated in the documents, this method of compromising closed networks is very similar to how <a href="https://en.wikipedia.org/wiki/Stuxnet" target="_blank">Stuxnet</a> worked.</p>
<p>The <em>Brutal Kangaroo</em> project consists of the following components: <em>Drifting Deadline</em> is the thumbdrive infection tool, <em>Shattered Assurance</em> is a server tool that handles automated infection of thumbdrives (as the primary mode of propagation for the <em>Brutal Kangaroo</em> suite), <em>Broken Promise</em> is the <em>Brutal Kangaroo</em> postprocessor (to evaluate collected information) and <em>Shadow</em> is the primary persistence mechanism (a stage 2 tool that is distributed across a closed network and acts as a covert command-and-control network; once multiple <em>Shadow</em> instances are installed and share drives, tasking and payloads can be sent back-and-forth).</p>
<p>The primary execution vector used by infected thumbdrives is a vulnerability in the Microsoft Windows operating system that can be exploited by hand-crafted link files that load and execute programs (DLLs) without user interaction. Older versions of the tool suite used a mechanism called <em>EZCheese</em> that was a <a href="https://nvd.nist.gov/vuln/detail/CVE-2015-0096" target="_blank">0-day exploit until March 2015</a>; newer versions seem use a similar, but yet unknown link file vulnerability (<em>Lachesis</em>/<em>RiverJack</em>) related to the library-ms functionality of the operating system.</p>

          
        </div>

        
        <div class="leak-sidebar">
          
    <h2>Leaked Documents</h2>
  
  <div class="sidebar-section">
  
    <div class="sidebar-item">
      <a href="./document/Brutal_Kangaroo-DriftingDeadline-V1_2-User_Guide/"/>
        <img src="./img/document.png"/>
        Brutal Kangaroo -- Drifting Deadline v1.2 - User Guide
      </a>
    </div>
    <br/>
    
  
    <div class="sidebar-item">
      <a href="./document/EzCheese-v6_3-User_Guide_Rev__2014-01-07/"/>
        <img src="./img/document.png"/>
        EzCheese v6.3 - User Guide
      </a>
    </div>
    <br/>
    
  
    <div class="sidebar-item">
      <a href="./document/EzCheese-v6_2-User_Guide_Rev_B_2013-07-18/"/>
        <img src="./img/document.png"/>
        EzCheese v6.2 - User Guide (Rev. B)
      </a>
    </div>
    <br/>
    
  
    <div class="sidebar-item">
      <a href="./document/EzCheese-v6_2-User_Guide_Rev_A_2013-04-12/"/>
        <img src="./img/document.png"/>
        EzCheese v6.2 - User Guide (Rev. A)
      </a>
    </div>
    <br/>
    
  
    <div class="sidebar-item">
      <a href="./document/EZCheese-v6_2_IVV_TDR-Slides_07172013/"/>
        <img src="./img/document.png"/>
        EZCheese v6.2 - IVV TDR Slides
      </a>
    </div>
    <br/>
    
      <div class="sidebar-item">
        <a href="./document#brutalkangaroo">See more</a>
      </div>
    
  
  </div>

          
  <div class="sidebar-section">
  
  </div>
        </div>
      </div>
    
      <div id="Cherry Blossom" class="release">
        <h1>Cherry Blossom</h1>
        <div class="date">
          15 June, 2017
          
        </div>

        <div class="leak-content">
          <p>Today, June 15th 2017, WikiLeaks publishes documents from the <em>CherryBlossom</em> project of the CIA that was developed and implemented with the help of the US nonprofit <a href="https://www.sri.com" target="_blank">Stanford Research Institute (SRI International)</a>.</p>
<p><em>CherryBlossom</em> provides a means of monitoring the Internet activity of and performing software exploits on <em>Targets</em> of interest. In particular, <em>CherryBlossom</em> is focused on compromising wireless networking devices, such as wireless routers and access points (APs), to achieve these goals. Such Wi-Fi devices are commonly used as part of the Internet infrastructure in private homes, public spaces (bars, hotels or airports), small and medium sized companies as well as enterprise offices. Therefore these devices are the ideal spot for "Man-In-The-Middle" attacks, as they can easily monitor, control and manipulate the Internet traffic of connected users. By altering the data stream between the user and Internet services, the infected device can inject malicious content into the stream to exploit vulnerabilities in applications or the operating system on the computer of the targeted user.</p>
<p>The wireless device itself is compromized by implanting a customized <em>CherryBlossom</em> firmware on it; some devices allow upgrading their firmware over a wireless link, so no physical access to the device is necessary for a successful infection. Once the new firmware on the device is flashed, the router or access point will become a so-called <em>FlyTrap</em>. A <em>FlyTrap</em> will beacon over the Internet to a Command &amp; Control server referred to as the <em>CherryTree</em>. The beaconed information contains device status and security information that the <em>CherryTree</em> logs to a database. In response to this information, the <em>CherryTree</em> sends a <em>Mission</em> with operator-defined tasking. An operator can use <em>CherryWeb</em>, a browser-based user interface to view <em>Flytrap</em> status and security info, plan <em>Mission</em> tasking, view <em>Mission</em>-related data, and perform system administration tasks.</p>
<p><em>Missions</em> may include tasking on <em>Targets</em> to monitor, actions/exploits to perform on a <em>Target</em>, and instructions on when and how to send the next beacon. Tasks for a <em>Flytrap</em> include (among others) the scan for <em>email addresses</em>, <em>chat usernames</em>, <em>MAC addresses</em> and <em>VoIP numbers</em> in passing network traffic to trigger additional actions, the copying of the full network traffic of a <em>Target</em>,  the redirection of a <em>Target</em>’s browser (e.g., to Windex for browser exploitation) or the proxying of a <em>Target</em>’s network connections. <em>FlyTrap</em> can also setup VPN tunnels to a <em>CherryBlossom</em>-owned VPN server to give an operator access to clients on the <em>Flytrap</em>’s  WLAN/LAN for further exploitation. When the <em>Flytrap</em> detects a <em>Target</em>, it will send an <em>Alert</em> to the <em>CherryTree</em> and commence any actions/exploits against the <em>Target</em>. The <em>CherryTree</em> logs <em>Alerts</em> to a database, and, potentially distributes <em>Alert</em> information to interested parties (via <em>Catapult</em>).</p>

          
        </div>

        
        <div class="leak-sidebar">
          
    <h2>Leaked Documents</h2>
  
  <div class="sidebar-section">
  
    <div class="sidebar-item">
      <a href="./document/SRI-SLO-FF-2012-177-CherryBlossom_SystemReqSpecDoc_CDRL-10_SLO-FF-2012-176/"/>
        <img src="./img/document.png"/>
        CherryBlossom -- System Req Spec (CDRL-10)
      </a>
    </div>
    <br/>
    
  
    <div class="sidebar-item">
      <a href="./document/SRI-SLO-FF-2012-177-CherryBlossom_QuickStartGuide_SLO-FF-2012-170/"/>
        <img src="./img/document.png"/>
        CherryBlossom -- Quick Start Guide
      </a>
    </div>
    <br/>
    
  
    <div class="sidebar-item">
      <a href="./document/WiFi_Devices/"/>
        <img src="./img/document.png"/>
        WiFi Devices
      </a>
    </div>
    <br/>
    
  
    <div class="sidebar-item">
      <a href="./document/SRI-SLO-FF-2012-177-CherryBlossom_InstallationGuide_SLO-FF-2012-172/"/>
        <img src="./img/document.png"/>
        CherryBlossom -- Installation Guide
      </a>
    </div>
    <br/>
    
  
    <div class="sidebar-item">
      <a href="./document/Cherry-Blossom-Operating-Environment/"/>
        <img src="./img/document.png"/>
        CherryBlossom -- Operating Environment (S//NF)
      </a>
    </div>
    <br/>
    
      <div class="sidebar-item">
        <a href="./document#cherryblossom">See more</a>
      </div>
    
  
  </div>

          
  <div class="sidebar-section">
  
  </div>
        </div>
      </div>
    
      <div id="Pandemic" class="release">
        <h1>Pandemic</h1>
        <div class="date">
          1 June, 2017
          
        </div>

        <div class="leak-content">
          <p>Today, June 1st 2017, WikiLeaks publishes documents from the "Pandemic" project of the CIA,  a persistent implant for Microsoft Windows machines that share files (programs) with remote users in a local network.  "Pandemic" targets remote users by replacing application code on-the-fly with a trojaned version if the program is retrieved from the infected machine. To obfuscate its activity, the original file on the file server remains unchanged; it is only modified/replaced while in transit from the pandemic file server before being executed on the computer of the remote user. The implant allows the replacement of up to 20 programs with a maximum size of 800 MB for a selected list of remote users (targets).</p>
<p>As the name suggests, a single computer on a local network with shared drives that is infected with the "Pandemic" implant will act like a "Patient Zero" in the spread of a disease. It will infect remote computers if the user executes programs stored on the pandemic file server. Although not explicitly stated in the documents, it seems technically feasible that remote computers that provide file shares themselves become new pandemic file servers on the local network to reach new targets.</p>

          
        </div>

        
        <div class="leak-sidebar">
          
    <h2>Leaked Documents</h2>
  
  <div class="sidebar-section">
  
    <div class="sidebar-item">
      <a href="./document/Pandemic-1_1-S-NF/"/>
        <img src="./img/document.png"/>
        Pandemic 1.1 (S/NF)
      </a>
    </div>
    <br/>
    
  
    <div class="sidebar-item">
      <a href="./document/RC1-doc-Pandemic-1_1-S-NF/"/>
        <img src="./img/document.png"/>
        Pandemic 1.1-RC1 (S/NF)
      </a>
    </div>
    <br/>
    
  
    <div class="sidebar-item">
      <a href="./document/RC1-doc-IVVRR_Checklist_Pandemic1_1/"/>
        <img src="./img/document.png"/>
        Pandemic 1.1-RC1 -- IVVRR Checklist
      </a>
    </div>
    <br/>
    
  
    <div class="sidebar-item">
      <a href="./document/Pandemic-1_0-S-NF/"/>
        <img src="./img/document.png"/>
        Pandemic 1.0 (S/NF)
      </a>
    </div>
    <br/>
    
  
    <div class="sidebar-item">
      <a href="./document/IVVRR_Checklist_Pandemic_1_0/"/>
        <img src="./img/document.png"/>
        Pandemic 1.0 -- IVVRR Checklist
      </a>
    </div>
    <br/>
    
      <div class="sidebar-item">
        <a href="./document#pandemic">See more</a>
      </div>
    
  
  </div>

          
  <div class="sidebar-section">
  
  </div>
        </div>
      </div>
    
      <div id="Athena" class="release">
        <h1>Athena</h1>
        <div class="date">
          19 May, 2017
          
        </div>

        <div class="leak-content">
          <p>Today, May 19th 2017, WikiLeaks publishes documents from the "Athena" project of the CIA. "Athena" - like the related "Hera" system - provides remote beacon and loader capabilities on target computers running the Microsoft Windows operating system (from Windows XP to Windows 10).  Once installed, the malware provides a beaconing capability (including configuration and task handling), the memory loading/unloading of malicious payloads for specific tasks and the delivery and retrieval of files to/from a specified directory on the target system. It allows the operator to configure settings during runtime (while the implant is on target) to customize it to an operation.</p>
<p>According to the documentation (see <a href="/vault7/document/AthenaTechnologyOverview/" target="_blank">Athena Technology Overview</a>), the malware was developed by the CIA in cooperation with <a href="http://www.siegetechnologies.com/" target="_blank">Siege Technologies</a>, a self-proclaimed cyber security company based in New Hampshire, US. On their website, Siege Technologies states that the company "<i>... focuses on leveraging <b>offensive cyberwar technologies</b> and methodologies to develop predictive cyber security solutions for insurance, government and other targeted markets.</i>". On November 15th, 2016 <a href="https://nehemiahsecurity.com/nehemiah-security-acquires-siege-technologies/" target="_blank">Nehemiah Security</a> announced the acquisition of Siege Technologies.</p>
<p>In an email from HackingTeam (published by WikiLeaks <a href="https://wikileaks.org/hackingteam/emails/emailid/169933" target="_blank">here</a>), Jason Syversen, founder of Siege Technologies with a background in cryptography and hacking, "<i>... said he set out to create the equivalent of the military’s so-called probability of kill metric, a statistical analysis of whether an attack is likely to succeed. 'I feel more comfortable working on electronic warfare,' he said. 'It’s a little different than bombs and nuclear weapons -- that’s a morally complex field to be in. Now instead of bombing things and having collateral damage, you can really reduce civilian casualties, which is a win for everybody.'</i>"</p>

          
        </div>

        
        <div class="leak-sidebar">
          
    <h2>Leaked Documents</h2>
  
  <div class="sidebar-section">
  
    <div class="sidebar-item">
      <a href="./document/Athena-v1_0-UserGuide/"/>
        <img src="./img/document.png"/>
        Athena v1.0 User Guide
      </a>
    </div>
    <br/>
    
  
    <div class="sidebar-item">
      <a href="./document/AthenaTechnologyOverview/"/>
        <img src="./img/document.png"/>
        Athena Technology Overview
      </a>
    </div>
    <br/>
    
  
    <div class="sidebar-item">
      <a href="./document/AthenaDesign/"/>
        <img src="./img/document.png"/>
        Athena (Design)
      </a>
    </div>
    <br/>
    
  
    <div class="sidebar-item">
      <a href="./document/ATHENA-DEMO/"/>
        <img src="./img/document.png"/>
        Athena (Demo)
      </a>
    </div>
    <br/>
    
  
    <div class="sidebar-item">
      <a href="./document/Design_Engine/"/>
        <img src="./img/document.png"/>
        Athena (Design/Engine)
      </a>
    </div>
    <br/>
    
      <div class="sidebar-item">
        <a href="./document#athena">See more</a>
      </div>
    
  
  </div>

          
  <div class="sidebar-section">
  
  </div>
        </div>
      </div>
    
      <div id="AfterMidnight" class="release">
        <h1>AfterMidnight</h1>
        <div class="date">
          12 May, 2017
          
        </div>

        <div class="leak-content">
          <p>Today, May 12th 2017, WikiLeaks publishes "AfterMidnight" and "Assassin", two CIA malware frameworks for the Microsoft Windows platform.</p>
<p>"AfterMidnight" allows operators to dynamically load and execute malware payloads on a target machine. The  main controller disguises as a self-persisting Windows Service DLL and provides secure execution of "Gremlins" via a HTTPS based Listening Post (LP) system called "Octopus". Once installed on a target machine AM will call back to a configured LP on a configurable schedule, checking to see if there is a new plan for it to execute. If there is, it downloads and stores all needed components before loading all new gremlins in memory. "Gremlins" are small  AM payloads that are meant to run hidden on the target and either subvert the functionality of targeted software,  survey the target (including data exfiltration) or provide internal services for other gremlins. The special payload "AlphaGremlin" even has a custom script language which allows operators to schedule custom tasks to be executed on the target machine.</p>
<p>"Assassin"  is a similar kind of malware; it is an automated implant that provides a simple collection platform on remote computers running the Microsoft Windows operating system. Once the tool is installed on the target, the implant is run within a Windows service process. "Assassin" (just like "AfterMidnight")  will then periodically beacon to its configured listening post(s) to request tasking and deliver results. Communication occurs over one or more transport protocols as configured before or during deployment. The "Assassin" C2 (Command and Control)  and LP (Listening Post) subsystems are referred to collectively as" The Gibson" and allow operators to perform specific tasks on an infected target..</p>

          
        </div>

        
        <div class="leak-sidebar">
          
    <h2>Leaked Documents</h2>
  
  <div class="sidebar-section">
  
    <div class="sidebar-item">
      <a href="./document/AfterMidnight_v1_0_Users_Guide/"/>
        <img src="./img/document.png"/>
        AfterMidnight v1.0 Users Guide
      </a>
    </div>
    <br/>
    
  
    <div class="sidebar-item">
      <a href="./document/AlphaGremlin_v01_0_Users_Guide/"/>
        <img src="./img/document.png"/>
        AlphaGremlin v0.1.0 Users Guide
      </a>
    </div>
    <br/>
    
  
    <div class="sidebar-item">
      <a href="./document/aftermidnight_diagrams/"/>
        <img src="./img/document.png"/>
        AfterMidnight Diagrams
      </a>
    </div>
    <br/>
    
  
    <div class="sidebar-item">
      <a href="./document/Assassin_v1_4_Users_Guide/"/>
        <img src="./img/document.png"/>
        Assassin v1.4 Users Guide
      </a>
    </div>
    <br/>
    
  
    <div class="sidebar-item">
      <a href="./document/Assassin_v1_3_Users_Guide/"/>
        <img src="./img/document.png"/>
        Assassin v1.3 Users Guide
      </a>
    </div>
    <br/>
    
      <div class="sidebar-item">
        <a href="./document#assassin">See more</a>
      </div>
    
  
  </div>

          
  <div class="sidebar-section">
  
  </div>
        </div>
      </div>
    
      <div id="Archimedes" class="release">
        <h1>Archimedes</h1>
        <div class="date">
          5 May, 2017
          
        </div>

        <div class="leak-content">
          <p>Today, May 5th 2017, WikiLeaks publishes "Archimedes", a tool used by the CIA to attack a computer inside a Local Area Network (LAN), usually used in offices. It allows the re-directing of traffic from the target computer inside the LAN through a computer infected with this malware and controlled by the CIA. This technique is used by the CIA to redirect the target's computers web browser to an exploitation server while appearing as a normal browsing session.</p>
<p>The document illustrates a type of attack within a "protected environment" as the the tool is deployed into an existing local network abusing existing machines to bring targeted computers under control and allowing further exploitation and abuse.</p>

          
        </div>

        
        <div class="leak-sidebar">
          
    <h2>Leaked Documents</h2>
  
  <div class="sidebar-section">
  
    <div class="sidebar-item">
      <a href="./document/Archimedes-1_0-User_Guide/"/>
        <img src="./img/document.png"/>
        Archimedes 1.0 User Guide
      </a>
    </div>
    <br/>
    
  
    <div class="sidebar-item">
      <a href="./document/Archimedes-1_3-Addendum/"/>
        <img src="./img/document.png"/>
        Archimedes 1.3 Addendum
      </a>
    </div>
    <br/>
    
  
    <div class="sidebar-item">
      <a href="./document/Archimedes-1_2-Addendum/"/>
        <img src="./img/document.png"/>
        Archimedes 1.2 Addendum
      </a>
    </div>
    <br/>
    
  
    <div class="sidebar-item">
      <a href="./document/Archimedes-1_1-Addendum/"/>
        <img src="./img/document.png"/>
        Archimedes 1.1 Addendum
      </a>
    </div>
    <br/>
    
  
    <div class="sidebar-item">
      <a href="./document/Fulcrum-User_Manual-v0_62/"/>
        <img src="./img/document.png"/>
        Fulcrum User Manual v0.62
      </a>
    </div>
    <br/>
    
      <div class="sidebar-item">
        <a href="./document#archimedes">See more</a>
      </div>
    
  
  </div>

          
  <div class="sidebar-section">
  
  </div>
        </div>
      </div>
    
      <div id="Scribbles" class="release">
        <h1>Scribbles</h1>
        <div class="date">
          28 April, 2017
          
        </div>

        <div class="leak-content">
          <p>Today, April 28th 2017, WikiLeaks publishes the documentation and source code
for CIA's "Scribbles" project, a document-watermarking preprocessing system
to embed "Web beacon"-style tags into documents that are likely to be copied
by Insiders, Whistleblowers, Journalists or others.  The released version (v1.0 RC1) is
dated March, 1st 2016 and classified SECRET//ORCON/NOFORN until 2066.</p>
<p>Scribbles is intended for off-line preprocessing of Microsoft Office documents.
For reasons of operational security the user guide demands that "[t]he Scribbles
executable, parameter files, receipts and log files should not be installed on
a target machine, nor left in a location where it might be collected by an
adversary."</p>
<p>According to the documentation, "the Scribbles document watermarking tool has
been successfully tested on [...] Microsoft Office 2013 (on Windows 8.1 x64),
documents from Office versions 97-2016  (Office 95 documents will not work!)
[and d]ocuments that are not be locked forms, encrypted, or password-protected".
But this limitation to Microsoft Office documents seems to create problems:
"If the targeted end-user opens them up in a different application, such as
OpenOffice or LibreOffice, the watermark images and URLs may be visible to the
end-user. For this reason, always make sure that the host names and URL
components are logically consistent with the original content. If you are 
concerned that the targeted end-user may open these documents in a non-Microsoft
Office application, please take some test documents and evaluate them in the
likely application before deploying them."</p>
<p>Security researches and forensic experts will find more detailed information
on how watermarks are applied to documents in the source code, which is
included in this publication as a zipped archive.</p>

          
        </div>

        
        <div class="leak-sidebar">
          
    <h2>Leaked Documents</h2>
  
  <div class="sidebar-section">
  
    <div class="sidebar-item">
      <a href="./document/Scribbles_v1_0_RC1-User_Guide/"/>
        <img src="./img/document.png"/>
        Scribbles v1.0 RC1 - User Guide
      </a>
    </div>
    <br/>
    
  
    <div class="sidebar-item">
      <a href="./document/Scribbles/"/>
        <img src="./img/document.png"/>
        Scribbles (Source Code)
      </a>
    </div>
    <br/>
    
  
    <div class="sidebar-item">
      <a href="./document/Scribbles_v1_0_RC1-IVVRR_Checklist/"/>
        <img src="./img/document.png"/>
        Scribbles v1.0 RC1 - IVVRR Checklist
      </a>
    </div>
    <br/>
    
  
    <div class="sidebar-item">
      <a href="./document/Scribbles_v1_0_RC1-Readiness_Review_Worksheet/"/>
        <img src="./img/document.png"/>
        Scribbles v1.0 RC1 - Readiness Review Worksheet
      </a>
    </div>
    <br/>
    
  
  </div>

          
  <div class="sidebar-section">
  
  </div>
        </div>
      </div>
    
      <div id="Weeping Angel" class="release">
        <h1>Weeping Angel</h1>
        <div class="date">
          21 April, 2017
          
        </div>

        <div class="leak-content">
          <p>Today, April 21st 2017, WikiLeaks publishes the User Guide for CIA's "Weeping Angel" tool - an implant designed for Samsung F Series Smart Televisions. Based on the "Extending" tool from the MI5/BTSS, the implant is designed to record audio from the built-in microphone and egress or store the data.</p>
<p>The classification marks of the User Guide document hint that is was originally written by the british MI5/BTSS and later shared with the CIA. Both agencies collaborated on the further development of the malware and coordinated their work in Joint Development Workshops.</p>

          
        </div>

        
        <div class="leak-sidebar">
          
    <h2>Leaked Documents</h2>
  
  <div class="sidebar-section">
  
    <div class="sidebar-item">
      <a href="./document/EXTENDING_User_Guide/"/>
        <img src="./img/document.png"/>
        Extending - User Guide
      </a>
    </div>
    <br/>
    
  
  </div>

          
  <div class="sidebar-section">
  
  </div>
        </div>
      </div>
    
      <div id="Hive" class="release">
        <h1>Hive</h1>
        <div class="date">
          14 April, 2017
          
        </div>

        <div class="leak-content">
          <p>Today, April 14th 2017, WikiLeaks publishes six documents from the CIA's <a href="https://wikileaks.org/ciav7p1/cms/page_7995396.html" target="_blank">HIVE</a>  project created by its <a href="https://wikileaks.org/ciav7p1/cms/page_753667.html" target="_blank"> "Embedded Development Branch"</a> (EDB).</p>
<p>HIVE is a back-end infrastructure malware with a public-facing HTTPS interface which is used by CIA implants to transfer exfiltrated information  from target machines to the CIA and to receive commands from its operators to execute specific tasks on the targets. HIVE is used across multiple malware implants and CIA operations. The public HTTPS interface utilizes unsuspicious-looking cover domains to hide its presence.</p>
<p>Anti-Virus companies and forensic experts have noticed that some possible state-actor malware used such kind of back-end infrastructure by analyzing the communication behaviour of these specific implants, but were unable to attribute the back-end (and therefore the implant itself) to operations run by the CIA. In a recent
<a href="https://www.symantec.com/connect/blogs/longhorn-tools-used-cyberespionage-group-linked-vault-7" target="_blank">blog post by Symantec</a>, that was able to attribute the "Longhorn" activities to the CIA based on the <a href="https://wikileaks.org/ciav7p1/" target="_blank">Vault 7</a>, such back-end infrastructure is described:</p>
<div style="margin-left: 3em"><i>
For C&C servers, Longhorn typically configures a specific domain and IP address combination per target. The domains appear to be registered by the attackers; however they use privacy services to hide their real identity. The IP addresses are typically owned by legitimate companies offering virtual private server (VPS) or webhosting services. The malware communicates with C&C servers over HTTPS using a custom underlying cryptographic protocol to protect communications from identification.
</i></div><p>The documents from this publication might further enable anti-malware researchers and forensic experts to analyse this kind of communication between malware implants and back-end servers used in previous illegal activities.</p>

          
        </div>

        
        <div class="leak-sidebar">
          
    <h2>Leaked Documents</h2>
  
  <div class="sidebar-section">
  
    <div class="sidebar-item">
      <a href="./document/hive-UsersGuide/"/>
        <img src="./img/document.png"/>
        Users Guide
      </a>
    </div>
    <br/>
    
  
    <div class="sidebar-item">
      <a href="./document/hive-DevelopersGuide/"/>
        <img src="./img/document.png"/>
        Developers Guide
      </a>
    </div>
    <br/>
    
  
    <div class="sidebar-item">
      <a href="./document/hive-DevelopersGuide-figures/"/>
        <img src="./img/document.png"/>
        Developers Guide (Figures)
      </a>
    </div>
    <br/>
    
  
    <div class="sidebar-item">
      <a href="./document/hive-Operating_Environment/"/>
        <img src="./img/document.png"/>
        Hive Beacon Infrastructure
      </a>
    </div>
    <br/>
    
  
    <div class="sidebar-item">
      <a href="./document/hive-Infrastructure-Configuration_Guide/"/>
        <img src="./img/document.png"/>
        Hive Infrastructure Installation and Configuration Guide
      </a>
    </div>
    <br/>
    
      <div class="sidebar-item">
        <a href="./document#hive">See more</a>
      </div>
    
  
  </div>

          
  <div class="sidebar-section">
  
  </div>
        </div>
      </div>
    
      <div id="Grasshopper" class="release">
        <h1>Grasshopper</h1>
        <div class="date">
          7 April, 2017
          
        </div>

        <div class="leak-content">
          <p>Today, April 7th 2017, WikiLeaks releases Vault 7 "Grasshopper" -- 27 documents from the CIA's <a href="https://wikileaks.org/ciav7p1/cms/page_12353652.html" target="_blank">Grasshopper framework</a>, a platform used to build customized malware payloads for Microsoft Windows operating systems.</p>
<p>Grasshopper is provided with a variety of modules that can be used by a CIA operator as blocks to construct a customized implant that will behave differently, for example maintaining persistence on the computer differently, depending on what particular features or capabilities are selected in the process of building the bundle. Additionally, Grasshopper provides a very flexible language to define rules that are used to "perform a pre-installation survey of the target device, assuring that the payload will only [be] installed if the target has the right configuration". Through this grammar CIA operators are able to build from very simple to very complex logic used to determine, for example, if the target device is running a specific version of Microsoft Windows, or if a particular Antivirus product is running or not.</p>
<p>Grasshopper allows tools to be installed using a variety of persistence mechanisms and modified using a variety of extensions (like encryption). The <a href="https://wikileaks.org/ciav7p1/cms/page_12353654.html" target="_blank">requirement list</a> of the <i>Automated Implant Branch</i> (AIB) for Grasshopper puts special attention on <a href="https://wikileaks.org/ciav7p1/cms/page_14587218.html" target="_blank">PSP avoidance</a>, so that any <i>Personal Security Products</i> like 'MS Security Essentials', 'Rising', 'Symantec Endpoint' or 'Kaspersky IS' on target machines do not detect Grasshopper elements.</p>
<p>One of the persistence mechanisms used by the CIA here is 'Stolen Goods' - whose "components were taken from malware known as Carberp, a suspected Russian organized crime rootkit." confirming the <a href="https://wikileaks.org/ciav7p1/cms/page_2621753.html" target="_blank">recycling of malware</a> found on the Internet by the CIA. "The source of Carberp was  published online, and has allowed AED/RDB to easily steal components as needed from the malware.". While the CIA claims that "[most] of Carberp was not used in Stolen Goods" they do acknowledge that "[the] persistence method, and parts of the installer, were taken and modified to fit our needs", providing a further example of reuse of portions of publicly available malware by the CIA, as observed in their <a href="https://wikileaks.org/ciav7p1/cms/page_22642800.html" target="_blank">analysis of leaked material from the italian company "HackingTeam"</a>.</p>
<p>The documents WikiLeaks publishes today provide an insights into the process of building modern espionage tools and insights into how the CIA maintains persistence over infected Microsoft Windows computers, providing directions for those seeking to defend their systems to identify any existing compromise</p>

          
        </div>

        
        <div class="leak-sidebar">
          
    <h2>Leaked Documents</h2>
  
  <div class="sidebar-section">
  
    <div class="sidebar-item">
      <a href="./document/Grasshopper-v1_1-AdminGuide/"/>
        <img src="./img/document.png"/>
        Grasshopper-v1_1-AdminGuide
      </a>
    </div>
    <br/>
    
  
    <div class="sidebar-item">
      <a href="./document/Grasshopper-v2_0_2-UserGuide/"/>
        <img src="./img/document.png"/>
        Grasshopper-v2_0_2-UserGuide
      </a>
    </div>
    <br/>
    
  
    <div class="sidebar-item">
      <a href="./document/StolenGoods-2_1-UserGuide/"/>
        <img src="./img/document.png"/>
        StolenGoods-2_1-UserGuide
      </a>
    </div>
    <br/>
    
  
    <div class="sidebar-item">
      <a href="./document/GH-Module-Null-v2_0-UserGuide/"/>
        <img src="./img/document.png"/>
        GH-Module-Null-v2_0-UserGuide
      </a>
    </div>
    <br/>
    
  
    <div class="sidebar-item">
      <a href="./document/GH-Module-Buffalo-Bamboo-v1_0-UserGuide/"/>
        <img src="./img/document.png"/>
        GH-Module-Buffalo-Bamboo-v1_0-UserGuide
      </a>
    </div>
    <br/>
    
      <div class="sidebar-item">
        <a href="./document#grasshopper">See more</a>
      </div>
    
  
  </div>

          
  <div class="sidebar-section">
  
  </div>
        </div>
      </div>
    
      <div id="Marble Framework" class="release">
        <h1>Marble Framework</h1>
        <div class="date">
          31 March, 2017
          
        </div>

        <div class="leak-content">
          <p>Today, March 31st 2017, WikiLeaks releases <a href="https://wikileaks.org/ciav7p1/">Vault 7</a> "Marble" -- <a href="https://wikileaks.org/vault7/document/Marble/Marble.zip">676 source code files</a> for the CIA's secret anti-forensic <a href="https://wikileaks.org/ciav7p1/cms/space_15204359.html">Marble Framework</a>. Marble is used to hamper forensic investigators and anti-virus companies from attributing viruses, trojans and hacking attacks to the CIA.</p>
<p>Marble does this by hiding ("obfuscating") text fragments used in <a href="https://wikileaks.org/ciav7p1/">CIA malware</a> from visual inspection. This is the digital equivallent of a specalized CIA tool to place covers over the english language text on U.S. produced weapons systems before giving them to insurgents secretly backed by the CIA.</p>
<p>Marble forms part of the CIA's <a href="https://wikileaks.org/ciav7p1/cms/page_11629046.html">anti-forensics approach</a> and the CIA's <a href="https://wikileaks.org/ciav7p1/cms/page_13763406.html">Core Library</a> of malware code. It is "<i>[D]esigned to allow for flexible and easy-to-use obfuscation</i>" as "<i>string obfuscation algorithms (especially those that are unique) are often used to link malware to a specific developer or development shop.</i>"</p>
<p>The Marble source code also includes a <i>deobfuscator</i> to reverse CIA text obfuscation. Combined with the revealed obfuscation techniques, a pattern or signature emerges which can assist forensic investigators attribute previous hacking attacks and viruses to the CIA. Marble was in use at the CIA during 2016. It reached 1.0 in 2015.</p>
<p>The source code shows that Marble has test examples not just in English but also in Chinese, Russian, Korean, Arabic and Farsi. This would permit a forensic attribution double game, for example by pretending that the spoken language of the malware creator was not American English, but Chinese, but then showing attempts to conceal the use of Chinese, drawing forensic investigators even more strongly to the wrong conclusion, --- but there are other possibilities, such as hiding fake error messages.</p>
<p>The Marble Framework is used for obfuscation only and does not contain any vulnerabilties or exploits by itself.</p>

          
        </div>

        
        <div class="leak-sidebar">
          
    <h2>Leaked Documents</h2>
  
  <div class="sidebar-section">
  
    <div class="sidebar-item">
      <a href="./document/Marble/"/>
        <img src="./img/document.png"/>
        Marble Framework (Source Code)
      </a>
    </div>
    <br/>
    
  
  </div>

          
  <div class="sidebar-section">
  
  </div>
        </div>
      </div>
    
      <div id="Dark Matter" class="release">
        <h1>Dark Matter</h1>
        <div class="date">
          23 March, 2017
          
        </div>

        <div class="leak-content">
          <p>Today, March 23rd 2017, WikiLeaks releases Vault 7 "Dark Matter", which contains documentation for several CIA projects that infect Apple Mac  firmware (meaning the infection persists even if the operating system is re-installed) developed by the CIA's Embedded Development Branch (EDB). These documents explain the techniques used by CIA to gain 'persistence' on Apple Mac devices, including Macs and iPhones and demonstrate their use of EFI/UEFI and firmware malware.</p>
<p>Among others, these documents reveal the "Sonic Screwdriver" project which, as explained by the CIA, is a "mechanism for executing code on peripheral devices while a Mac laptop or desktop is booting" allowing an attacker to boot its attack software for example from a USB stick "even when a firmware password is enabled". The CIA's "Sonic Screwdriver" infector is stored on the modified firmware of an Apple Thunderbolt-to-Ethernet adapter.</p>
<p>"DarkSeaSkies" is "an implant that persists in the EFI firmware of an Apple MacBook Air computer" and consists of "DarkMatter", "SeaPea" and "NightSkies", respectively EFI, kernel-space and user-space implants.</p>
<p>Documents on the "Triton" MacOSX malware, its infector "Dark Mallet" and its EFI-persistent version "DerStarke" are also included in this release. While the DerStarke1.4 manual released today dates to 2013, other Vault 7 documents show that as of 2016 the CIA continues to rely on and update these systems and is working on the production of <a href="https://wikileaks.org/ciav7p1/cms/page_13763820.html">DerStarke2.0</a>.</p>
<p>Also included in this release is the manual for the CIA's "NightSkies 1.2" a "beacon/loader/implant tool" for the Apple iPhone. Noteworthy is that NightSkies had reached 1.2 by 2008, and is expressly designed to be physically installed onto factory fresh iPhones. i.e the CIA has been infecting the iPhone supply chain of its targets since at least 2008.</p>
<p>While CIA assets are sometimes used to physically infect systems in the custody of a target it is likely that many CIA physical access attacks have infected the targeted organization's supply chain including by interdicting mail orders and other shipments (opening, infecting, and resending) leaving the United States or otherwise.</p>

          
        </div>

        
        <div class="leak-sidebar">
          
    <h2>Leaked Documents</h2>
  
  <div class="sidebar-section">
  
    <div class="sidebar-item">
      <a href="./document/SonicScrewdriver_1p0/"/>
        <img src="./img/document.png"/>
        Sonic Screwdriver
      </a>
    </div>
    <br/>
    
  
    <div class="sidebar-item">
      <a href="./document/DerStarke_v1_4_DOC/"/>
        <img src="./img/document.png"/>
        DerStarke v1.4
      </a>
    </div>
    <br/>
    
  
    <div class="sidebar-item">
      <a href="./document/DerStarke_v1_4_RC1_IVVRR_Checklist/"/>
        <img src="./img/document.png"/>
        DerStarke v1.4 RC1 - IVVRR Checklist
      </a>
    </div>
    <br/>
    
  
    <div class="sidebar-item">
      <a href="./document/DarkSeaSkies_v1_0_Test_Plan_Procedures/"/>
        <img src="./img/document.png"/>
        DarkSeaSkies v1.0 - Test Plan Procedures
      </a>
    </div>
    <br/>
    
  
    <div class="sidebar-item">
      <a href="./document/FDOS_1_0_FINAL_freedos_setup_odin_fips/"/>
        <img src="./img/document.png"/>
        FDOS_1_0_FINAL_freedos_setup_odin_fips
      </a>
    </div>
    <br/>
    
      <div class="sidebar-item">
        <a href="./document#darkmatter">See more</a>
      </div>
    
  
  </div>

          
  <div class="sidebar-section">
  
  </div>
        </div>
      </div>
    
  </div>

  
    <div class="media-partners">
      <h2>Media Partners</h2>
      <ul>
    
    <li>DER SPIEGEL - Germany</li>
    
    <li>LA REPUBBLICA - Italy</li>
    
    <li>LIBERATION - France</li>
    
    <li>MEDIAPART - France</li>
    
  </ul>
      <h2>Expert Organizations</h2>
      <ul>
    
  </ul>
    </div>
  

    </div>
  </div>

  
  
<link href="/static/css/styles_footer.css" rel="stylesheet">
<footer id="page-footer" class="footer-recommendations">
  <div class="footer-wrapper">
    <div class="recommendation-container">
      <a href="#" class="top">Top</a>
      
        <ul class="recommendation-links">
                <li class="recommendation">
                    <a href="https://our.wikileaks.org" target="_blank">
                        <div class="teaser">
                            <img class="spip_logos" alt="" src="/IMG/arton666.png" width="360" height="240" />
                        </div>
                        <p><p>WL Research Community - user contributed research based on documents published by WikiLeaks. 
</p></p>
                    </a>
                </li>
            </li>
                <li class="recommendation">
                    <a href="https://www.torproject.org/" target="_blank">
                        <div class="teaser">
                            <img class="spip_logos" alt="" src="/IMG/arton401.png" width="360" height="240" />
                        </div>
                        <p><p>Tor is an encrypted anonymising network that makes it harder to intercept internet communications, or see where communications are coming from or going to.
</p></p>
                    </a>
                </li>
            </li>
                <li class="recommendation">
                    <a href="https://tails.boum.org/" target="_blank">
                        <div class="teaser">
                            <img class="spip_logos" alt="" src="/IMG/arton405.png" width="360" height="240" />
                        </div>
                        <p><p> Tails is a live operating system, that you can start on almost any computer from a DVD, USB stick, or SD card. It aims at preserving your privacy and anonymity.
</p></p>
                    </a>
                </li>
            </li>
                <li class="recommendation">
                    <a href="https://www.couragefound.org/" target="_blank">
                        <div class="teaser">
                            <img class="spip_logos" alt="" src="/IMG/arton404.png" width="360" height="240" />
                        </div>
                        <p><p>The Courage Foundation is an international organisation that supports those who risk life or liberty to make significant contributions to the historical record.
</p></p>
                    </a>
                </li>
            </li>
                <li class="recommendation">
                    <a href="https://www.bitcoin.org/" target="_blank">
                        <div class="teaser">
                            <img class="spip_logos" alt="" src="/IMG/arton403.png" width="360" height="240" />
                        </div>
                        <p><p>Bitcoin uses peer-to-peer technology to operate with no central authority or banks; managing transactions and the issuing of bitcoins is carried out collectively by the network.
</p></p>
                    </a>
                </li>
            </li>
        </ul>
      
      <ul class="social-links">
        <li>
          <a href="https://www.facebook.com/wikileaks" target="_blank" alt="Facebook">
            <img src="/static/img/fb-logo.png" alt="Facebook" title="Facebook page" />
          </a>
        </li>
        <li>
          <a href="https://twitter.com/wikileaks" target="_blank" alt="Twitter">
            <img src="/static/img/twitter-logo.png" alt="Twitter" title="Twitter page" />
          </a>
        </li>
      </ul>
    </div>
  </div>
</footer>


  
</body>
</html>
